package com.zhb.cms.oauth.config;

import java.security.KeyPair;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.ClassPathResource;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
import com.zhb.cms.oauth.custom.CustomOAuth2RequestFactory;

/**
 * Authorization config
 */
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter
{
	@Autowired
	private AuthenticationManager authenticationManager;
	@Autowired
	private DataSource dataSource;
	@Autowired
	private JdbcTemplate jdbcTemplate;
	@Autowired
	private ClientDetailsService clientDetailsService;
	@Autowired
	private RedisConnectionFactory redisConnectionFactory;
	/**
	 * jwt config
	 * JSON Web Token(JWT)
	 * @return
	 */
	//@Bean
/*	public JwtAccessTokenConverter jwtAccessTokenConverter()
	{
		JwtAccessTokenConverter converter = new CustomJwtAccessTokenConverter();
		//path password alias
		KeyPair keyPair = new KeyStoreKeyFactory(new ClassPathResource("root.jks"), "12344321".toCharArray())
				.getKeyPair("root");
		converter.setKeyPair(keyPair);
		return converter;
	}*/

	/**
	 * client config
	 */
	@Override
	public void configure(ClientDetailsServiceConfigurer clients) throws Exception
	{
		clients.jdbc(dataSource);
	}

	/**
	 * tokenStore scope jwt codeService
	 */
	@Override
	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception
	{
		//@formatter:off
		endpoints.authenticationManager(authenticationManager)
//		         .authorizationCodeServices(authorizationCodeServices())
/*				 .tokenStore(tokenStore())*/
		         .tokenStore(redisTokenStore())
				 .approvalStoreDisabled()
				 .requestFactory(new CustomOAuth2RequestFactory(clientDetailsService ,jdbcTemplate));
				/* .requestValidator(new CustomOAuth2RequestValidator());*/
				 //.accessTokenConverter(jwtAccessTokenConverter());
		//@formatter:on
	}

	/**
	 * tokenStore config
	 * in memory、jdbc、redis
	 * @return
	 */
/*	@Bean
	public JdbcTokenStore tokenStore()
	{
		//配置token保存机制，这里用mysql
		return new JdbcTokenStore(dataSource);
	}*/
	@Bean
	public TokenStore redisTokenStore(){
		return new RedisTokenStore(redisConnectionFactory);
	}
	/**
	 * AuthorizationCodeStore config
	 * @return
	 */
	/*@Bean
	protected AuthorizationCodeServices authorizationCodeServices()
	{
		return new JdbcAuthorizationCodeServices(dataSource);
	}*/

	/**
	 * defines the security constraints on the token endpoint.
	 */
	@Override
	public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception
	{
		//配置认证服务器的安全机制，permitAll放行所有，isAuthenticated被授权的
		oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
	}

}
